You do not need to know what the next big disruption is to prepare for it. Outages, ransomware, a vendor failure and a regional power loss all hit the same few weak points. This checklist is built from public guidance, including CISA's advisories and the NCSC Annual Review 2025, which counted 204 nationally significant incidents in the year to 31 August 2025.
What is affected
Any company that depends on a cloud provider, an identity provider, a payment processor, a package registry or a single IT admin.
How to check if you're exposed
Ask five questions. Can we restore from a backup that is offline? Can we log in if our identity provider is down? Do we know every library and vendor we depend on? Does one vendor carry more than half our operations? Who tells customers what, and how?
What to do now
- Backups. Keep regular, tested backups offline and isolated, as CISA advised in AA21-131A. Practise a full restore and time it.
- Offline access. Print or store offline the runbooks, contacts, and break glass credentials. Keep a second admin path.
- Dependency inventory. Generate an SBOM for each product and list SaaS vendors with owners. You cannot patch what you cannot name.
- Vendor concentration. Mark single points of failure, and for each write a fallback or an accepted risk.
- Remote access. Enforce MFA and remove internet exposed admin services.
- Manual mode. Define the minimum service you can deliver without systems.
- Communications plan. Draft a status page text, a customer email, and a call tree that work without your own email.
- Rehearse. Run a two hour tabletop twice a year.
How this could have been avoided
Public cases show the pattern: Colonial's advisory points to MFA, segmentation and offline backups; the CrowdStrike root cause was a content update with no attacker; Log4j teams with an inventory found affected products sooner. Each control above maps to one of these.
Why it matters
Resilience is mostly boring work done before the day. The checklist costs days, not budget, and it covers a long list of scenarios at once.
Try it yourself
The free scan runs in your browser, with no login, on a package.json, requirements.txt or SBOM of up to 100 dependencies: gold.safeguard.sh/scan. Then walk the vendor risk demo for your top three suppliers.
Click through it at your own pace, or open it full screen.
Quick check
What is the first thing to test in a backup plan?
A full restore from an offline copy, timed, since untested backups often fail when needed.
Why list vendors by concentration?
Because one supplier failing can stop most operations, and you want a fallback decided in advance.
